CVE-2026-91776: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-91776 is an Uncontrolled Resource Consumption (CWE-400) vulnerability in FasterXML jackson-databind that allows unauthenticated remote attackers to cause a denial of service via unbounded memory growth. The flaw exists in TypeDeserializerBase._findDeserializer(), which caches every distinct attacker-supplied type ID as a separate key in the _deserializers map — even when all unknown IDs resolve to the same fallback deserializer — with no bound on map size or key length. Affected versions include com.fasterxml.jackson.core:jackson-databind 2.0.0–2.18.10, 2.19.0–2.21.6, and 2.22.0–2.22.2, as well as tools.jackson.core:jackson-databind 3.0.0–3.1.6 and 3.2.0–3.2.2. The vulnerability was reported by Daniel Birtwhistle, the GitHub Security Advisory (GHSA-wv8q-qhhj-9h54) was published on September 22, 2026, and the CVE was assigned on September 23, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is CWE-400 (Uncontrolled Resource Consumption): TypeDeserializerBase._findDeserializer() writes the resolved deserializer into the shared _deserializers map keyed by the raw, attacker-supplied type ID string, without any bound on the number of entries or the length of keys. When name-based polymorphism is configured with a fallback (e.g., @JsonTypeInfo(use = Id.NAME, defaultImpl = SomeClass.class)), every distinct unrecognized type ID resolves to the same fallback deserializer but is stored as a unique key, causing the map to grow monotonically for the lifetime of the TypeDeserializer. Exploitation requires three preconditions: (1) the application uses name-based polymorphism with a defaultImpl or equivalent fallback, (2) attacker-controlled input can influence the type ID field, and (3) a long-lived ObjectMapper is reused across requests. The reporter confirmed that 10,000 distinct unknown type IDs produce 10,000 retained cache entries, while 10,000 repetitions of a single unknown ID produce only one entry, isolating key cardinality as the attack primitive (GitHub Advisory, GitHub PR #6203).

Successful exploitation causes monotonic, process-lifetime memory retention in the JVM heap, leading to availability pressure and eventual denial of service (OutOfMemoryError or severe GC pressure) against the affected application. There is no confidentiality or integrity impact — the vulnerability cannot be used for data exfiltration, code execution, or privilege escalation. Applications sharing a single ObjectMapper instance across many requests (a common production pattern) are most at risk, as the unbounded cache persists until the process is restarted (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is low-complexity and requires no authentication or user interaction, but is conditional on the specific application configuration (name-based polymorphism with a fallback and a shared ObjectMapper). The attack is a slow-burn resource exhaustion rather than an immediate crash, requiring sustained delivery of many distinct type IDs (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a target application that uses jackson-databind for JSON deserialization with a polymorphic type annotated with @JsonTypeInfo(use = Id.NAME, defaultImpl = ...) and exposes an HTTP endpoint accepting JSON input containing a type discriminator field.
2. Craft malicious payloads: Prepare a large set of JSON payloads where the type ID field (e.g., "type") contains a unique, previously unseen string value in each request (e.g., "type": "unknown_type_00001", "type": "unknown_type_00002", etc.).
3. Send sustained requests: Repeatedly POST these payloads to the target endpoint, cycling through thousands of distinct unknown type ID strings. Each request causes one new entry to be added to the _deserializers map in the shared TypeDeserializer.
4. Exhaust JVM heap: Continue sending requests with fresh type ID strings. The _deserializers map grows without bound for the lifetime of the process, consuming increasing heap memory until the JVM experiences severe GC pressure, OOM errors, or the application becomes unresponsive (GitHub Advisory, GitHub PR #6203).

• Network: High volume of HTTP requests to JSON deserialization endpoints with a polymorphic type field containing many distinct, random-looking string values; requests that are otherwise structurally valid but vary only in the type discriminator field.
• Application Logs: Repeated deserialization of unknown type IDs falling back to a default implementation, logged at WARN or DEBUG level by jackson-databind (if logging is enabled for com.fasterxml.jackson.databind).
• JVM Metrics: Monotonically increasing heap usage not correlated with legitimate traffic growth; frequent or prolonged garbage collection cycles; JVM heap dumps showing a large HashMap or ConcurrentHashMap within TypeDeserializerBase._deserializers with thousands of string keys.
• Process Behavior: Application slowdown or OOM errors (java.lang.OutOfMemoryError: Java heap space) in application logs, particularly under sustained but moderate request rates (GitHub Advisory).

FasterXML has released patched versions that stop caching fallback resolutions for unrecognized type IDs and bound the cache to a maximum of 1,000 entries (each key capped at 256 characters): 2.18.11, 2.21.7, 2.22.3, 3.1.7, and 3.2.3. Users should upgrade to the appropriate patched version as the primary remediation. As a short-term workaround where upgrading is not immediately possible, applications can avoid using defaultImpl with name-based polymorphism on endpoints that accept attacker-influenced input, or apply input validation to reject unexpected type ID values before deserialization. Dependency exclusions (as a temporary measure pending patch availability) are also documented in the community (GitHub Advisory, GitHub PR #6203).

The fix was developed collaboratively by FasterXML maintainer cowtowncoder and contributor pjfanning, with the pull request merged on September 14, 2026, ahead of the public advisory. Several downstream projects (including Exasol repositories and the parallel-consumer library) opened automated dependency update issues or applied temporary exclusions within days of disclosure, indicating broad ecosystem awareness. The OpenTelemetry Java project also flagged the dependency in a Sonatype audit workflow failure, reflecting the wide transitive reach of jackson-databind (GitHub PR #6203).